4 ms·
* Add a new private key format that uses a bcrypt KDF to better protect keys at rest. This is pretty important to me: Keys are much less of a hazard if tak
by mcpherrinm 13y ago
* Add a new private key format that uses a bcrypt KDF to better
protect keys at rest.
This is pretty important to me: Keys are much less of a hazard if taken off a stolen laptop/disk.
- jethro_tell 13y agoWhat is a KDF? What is this doing in layman's terms?
- swordswinger12 13y agoKey Derivation Function. It's a tool cryptographers use to derive cryptographic keys from different kinds of input material. Their most common use is to 'amplify' the entropy of a password or other low-entropy input and make it suitable for use as a key for a symmetric encryption scheme.
- sneak 13y agoWhen you type in your password to decrypt your ssh private key on disk, it runs the string (and optionally also some salt, stored in the clear with the encrypted key to foil rainbowtable lookup attacks) through a key derivation function, or KDF. The output is used as the encryption key for the symmetric cipher that protects the key at rest. One can use any cryptographically secure (output indistinguishable from random, infeasible to predict input given output, et c) hash as a KDF but the faster it is to run, the more per second an attacker can try when attempting to bruteforce your password/phrase after stealing your private key in its encrypted, on-disk format. bcrypt is a function that is specifically designed to be somewhat time consuming to calculate (with a variable difficulty argument to the function itself), to reduce the bruteforce rate (in normal use, it's only run once or twice, once for each password input). Its cousin scrypt was specifically designed to also require a fair bit of memory to calculate, as well, reducing effective parallelism in fpga/asic implementations as the memory circuits must be included as well. The difference between one <1ms hash and 100ms hash doesn't much matter to a user, but is the difference between a 10-char password being feasibly bruteforceable or not on dedicated hardware where you have to run 256^10 iterations. It adds up fast. My ssh private key password is 8 chars that match [a-z0-9]. This matters a lot.
- midas007 13y agoIdeally, a KDF should use as many resources as practical. The NIST competition process of favoring performant algorithms is not always in the interests of users because it means it's cheaper to bruteforce/crack.
- sp332 13y agoThe NIST competition was for a hash function, not a key derivation function.
- sneak 13y agoErr, more like 128^10 iterations, unless you have the unicode snowman in there.
- midas007 13y agoyourmagicnoncrappypassword -> 101010101110101111...
- MichaelGG 13y agoShouldn't your laptop/disks be fully encrypted anyways? It's good to have a strong KDF, but the stolen laptop threat should be already covered, I'd hope.
- jlgaddis 13y agoI have locks on my doors but that doesn't mean I don't have a pistol next to my bed.
- mcpherrinm 13y agoTrue, but what if it's stolen while the laptop is turned on and the disk keys are in memory? I rarely shut my laptop off, and while I may be a little overly paranoid, it is certainly possible for a local attacker to gain memory bus access and read out disk encryption keys. Multiple layers of security are always good!
- midas007 13y agoOr use monkeysphere and gpg keys that serve as ssh keys, which (gpg priv keys) is itself encrypted on encrypted disks with passphrase in an 10M rounds of AES25 encrypted password manager with a very long passphrase itself.